CVE-2026-105668

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-105668

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105668.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-105668

Aliases

EEF-CVE-2026-105668
GHSA-pqhp-5x9x-69h7

Published

2026-10-12T15:31:58Z

Modified

2026-10-14T02:46:17Z

Severity

7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Hex release-age cooldown is lifted package-wide when the locked release is retired

Details

Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account, to get a newly published release past the release-age cooldown.

The cooldown (cooldown config, HEX_COOLDOWN) withholds versions younger than the configured age during dependency resolution. When the release of a package locked in mix.lock is retired or has a security advisory, Hex.RemoteConverger.build_cooldown_bypass/3 and Hex.RemoteConverger.unsafe_lock_bypass/1 lift the cooldown for every version of that package and of every package the locked release depends on, so that mix deps.update can move off the unsafe release. Retiring a release needs the same package owner permission as publishing one. An attacker who publishes a malicious release can retire the currently locked release, and the next mix deps.update that unlocks the package selects the new release regardless of its age. Hex.Registry.Cooldown.versions/2 checks the bypass by package name alone, so the bypass also covers packages with the same name in other repositories. Cooldown configured through an organization dependency policy is not affected.

This issue affects hex: from 2.5.0 before 2.5.2.

Database specific

{
    "cna_assigner":  "EEF",
    "cwe_ids":  [
        "CWE-693"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105668.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "2.5.0"
                },
                {
                    "fixed":  "2.5.2"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/hexpm/hex

Affected ranges

Type

GIT

Repo

https://github.com/hexpm/hex

Events

Introduced

b4e665d46be8a5f81e8cbbe4c3a67058a19cf133

Fixed

1b6fddfeadd98ed26a143f60356efade0494e2ae

Fixed

b4e665d46be8a5f81e8cbbe4c3a67058a19cf133

Fixed

eed2bdf85320ae9e244629511c03f5f3f8c5d0b5

Database specific

Show details

{
    "source":  "REFERENCES"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105668.json"